ASP.NET MVC4 Redirect to login page

Question

I'm creating a web application using ASP.NET MVC 4 and C#.

I want all users to be logged in before using application.

I'm using ASP.NET Membership with a custom database.

One method is check if Membership.GetUser() is null or not in every function.

But isn't there any easier way than checking user login state in every function? (maybe checking in web.config, global.asax, etc...??)

Answer 1

当然，使用[Authorize]装饰你的动作或整个班级，它将要求用户首先登录。

Answer 2

Put [Authorize] over each action that you want only logged in users accessing. You can also do this at the controller level, making all actions within the controller secured. The latter is probably best for you, since you probably only want all of your pages disabled for guests.

Here's what the class-level one looks like:

[Authorize]
public class SomethingController
{
    //...
}

and here's an action-level one:

public class SomethingController
{
    [Authorize]
    public ActionResult SomeAction(Parameter someParameter)
    {
        //...   
    }
}

Another way to do it, if all or most of your pages use the same master page, is to put:

<script type="text/javascript>
    @if(!Request.IsAuthenticated) {
        window.location.href = redirectURL;
    }
</script>

or if you arent using razor syntax,

<script type="text/javascript>  
    <% if(!Request.IsAuthenticated) { %>
        window.location.href = redirectURL;
    <% } %>
</script>

in the master page. That way, all pages which use that master page will redirect elsewhere if the user is not logged in. This only applies if you are using the built-in authentication, though. NOTE: This option is far less secure than the first option. Use this only if site security is not a big concern

Answer 3

You could write a custom [Authorize] attribute. Then simply decorate controllers/actions with it or if all actions require authorization you could register it as a global action filter.

Answer 4

You can put [Authorize] attribute at your controller or at single methods in your controller so you would choose who can open the actions and with what permissions. You can also authorize with roles like : [Authorize(Roles="Admin")] where you will authorize only users in admin role to access your action/controller. For example:

[Authorize(Roles="SimpleUser")] or with no roles [Authorize]
public ActionResult Index()
{
    return View();
}

[Authorize]
[HttpPost]
public ActionResult Index(FormCollection form)
{
    ... whatever logic
    return View();
}

Hope this helps ;]

Answer 5

I know this question already has an answer but if the intention is to lock down the whole app except for a select few controller actions then I feel like this is a better solution ...

In the startup / init for your app add ...

httpConfig.filters.Add(new AuthorizeAttribute());

... then on actions you DONT want to secure ...

[AllowAnonymous]
public ActionResult Hello() { return View(); }

Answer 6

Use [Authorize] at the class level

if you want to allow anonymous access to some actions use [AllowAnonymous]